4 ms·

Unfortunately, it's without a hint of irony, as the same media companies deploy SSL/TLS on their websites for - at least - login and signup, taking payments, an

Unfortunately, it's without a hint of irony, as the same media companies deploy SSL/TLS on their websites for - at least - login and signup, taking payments, and more. I'm not sure if it's simply that no one has explained that SSL/TLS is encryption, and the nefarious things that could be done (stealing identity, credit cards) if certain communications aren't encrypted. In the end, it's more education, isn't it? Most things are. But in some cases, like this, it's a race between general education and political (and spy agency) advantage-taking. That's Snowden's greatest legacy - a few more people became educated, and the public frustration and pouting spy agencies are doing regarding encrypted communications are a bit more transparent than once they were.

eblanshey 11y ago
I'm pretty sure they are trying to push for encryption with government backdoor access. SSL certificates are issued by centralized authorities that can easily provide access to governments (if they don't do so already). Not that I agree with what they're trying to do.
- sliverstorm 11y ago
  Do they want attackable weaknesses in crypto, or a "master" key?
- alextgordon 11y ago
  CAs do not have backdoor access. The most a rogue CA can do is possibly enable a MITM against a website that has taken no protections. Google pins their public key fingerprints right into Chrome, and this feature is open: https://hstspreload.appspot.com/ https://hstspreload.appspot.com/
  - enlightenedfool 11y ago
    I don't understand. How can you be sure that they haven't shared their keys to the government?
    - xxpor 11y ago
      You don't need to send your private key to a CA to get a cert. You send them a CSR with your public key. https://en.wikipedia.org/wiki/Certificate_signing_request https://en.wikipedia.org/wiki/Certificate_signing_request Edit: Ah, if you were talking about the CA's private keys, then the parent is correct.
    - pimlottc 11y ago
      Having a CA's private keys only allows you to generate new signed certificates for a site, not decrypt traffic encrypted using an existing signed key pair. At best, it gives you the ability to spoof a website with a man-in-the-middle attack (e.g. you run a rogue wifi hotspot with a fake amazon.com that uses a private key you generated), although certificate-pinning would warn the user that Amazon's certificate had changed unexpectedly.

eblanshey 11y ago

I'm pretty sure they are trying to push for encryption with government backdoor access. SSL certificates are issued by centralized authorities that can easily provide access to governments (if they don't do so already). Not that I agree with what they're trying to do.

sliverstorm 11y ago
Do they want attackable weaknesses in crypto, or a "master" key?
alextgordon 11y ago
CAs do not have backdoor access. The most a rogue CA can do is possibly enable a MITM against a website that has taken no protections. Google pins their public key fingerprints right into Chrome, and this feature is open: https://hstspreload.appspot.com/ https://hstspreload.appspot.com/
- enlightenedfool 11y ago
  I don't understand. How can you be sure that they haven't shared their keys to the government?
  - xxpor 11y ago
    You don't need to send your private key to a CA to get a cert. You send them a CSR with your public key. https://en.wikipedia.org/wiki/Certificate_signing_request https://en.wikipedia.org/wiki/Certificate_signing_request Edit: Ah, if you were talking about the CA's private keys, then the parent is correct.
  - pimlottc 11y ago
    Having a CA's private keys only allows you to generate new signed certificates for a site, not decrypt traffic encrypted using an existing signed key pair. At best, it gives you the ability to spoof a website with a man-in-the-middle attack (e.g. you run a rogue wifi hotspot with a fake amazon.com that uses a private key you generated), although certificate-pinning would warn the user that Amazon's certificate had changed unexpectedly.